Feature request: JavaScript sanitisation

[a-h]

Script blocks support

This code:

{% script functionName(a int, b int) %}
  alert(a+b);
{% endscript %}

Will render:

<script>function functionName(a, b){alert(a+b};}</script>

Script blocks should not support script tags at all and should warn to use the {% script %} template instead

{% templ ScriptBlocksNotSupported(script string) %}
  <script type="text/javascript">
    {%= script %}
  </script>
{% endtempl %}

onClick / on* handlers should support constant values as well as {% script %} templates

{% templ BasicTemplate() %}
  <div>
	  <a onClick="alert('hello');">{%= "Say hello" %}</a>
  </div>
{% endtempl %}

Dynamic onClick / on* handlers with templates use sanitised values by forcing the use of {% script %} templates

The Google SafeHTML code describes how this can work: https://github.com/google/safehtml/blob/2057dd9c30f9e264f4d01c29d886d51f1b519302/script.go#L67

The named variables are inserted into the JavaScript template JSON escaped.

To render raw scripts, a templ.RawScript component can be used

This is described in the documentation, but not provided to encourage not doing that.